Extracted

• • Target

    797d18fdc2257084b4ef1d72567da313_JaffaCakes118

  • Size

    15.0MB

  • MD5

    797d18fdc2257084b4ef1d72567da313

  • SHA1

    d54a0fb342bb5ab844b86b922a8c7a5a8724168a

  • SHA256

    8c63222a0b3b7fc5f95f5e2210af53321011e5907a1b2400cf7a8eb35a935d59

  • SHA512

    c91cb7cf345e15897669aa0903974beaad66ee3e3b70ee50c523ea026fd6687720530ca5834b896e9fe1694171faec6c58b2709e2ac31a947d170e187eca90e7

  • SSDEEP

    393216:lLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLP:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2